From finding to incident
A finding is a single judgement about a single poll. An incident is the problem behind it. Findings that share a fingerprint — the same workflow and the same failure pattern — join the same incident instead of creating a new one, which is why a workflow failing every five minutes does not produce an inbox full of mail.
An incident stays open while the problem persists, and closes when the workflow is healthy again. The alert for the close is as useful as the alert for the open.
Deduplication, cooldown, escalation
- Deduplication
- The same problem on the same workflow is one incident, however many polls observe it.
- Cooldown
- After an alert is sent, OutcomeGuard stays quiet about that incident for a cooldown window even if the problem continues.
- Escalation
- A problem that outlives the cooldown escalates rather than repeating, so the second message tells you something new: how long it has been broken.
The practical result is one email per outage, a second only if it is still broken later, and a third when it recovers.
What an alert contains
- The workflow name and the signal — for example SILENT_FAILURE on “Daily invoice import”.
- The one-sentence reason, written to be forwarded as it is.
- The evidence rows: expected cadence, last run, item counts, terminal node, redacted error text.
- The confidence score, so a borderline judgement is visibly borderline.
- A link to the finding in the dashboard.
Alerts carry summary-level evidence only. Your business data is not in the email because it is not in OutcomeGuard.
Channels
Version 1 sends email. Recipients are set per workspace in the dashboard, which is what keeps client alerts separate on the Agency plan.
Slack, Microsoft Teams, Discord and generic webhooks are on the roadmap. We are not giving dates.
If an alert does not arrive
- Send a test alert from the dashboard to confirm the recipient list.
- Check the spam folder, and ask whoever runs your mail to allow the sending domain.
- Check whether the finding exists at all. If the workflow is in the insufficient-data list, there is nothing to alert on yet.
- Check whether the instance is reachable. A workflow whose instance is UNKNOWN is not reported as broken, because we do not know that it is.
Automatic recovery attempts
OutcomeGuard retries its own work when that is safe: re-running a failed check, re-sending a notification that did not go out, re-running a verification. These attempts are recorded alongside the incident.
It does not retry your workflows, rewrite them, or change credentials. Anything that changes your system is yours to do.